---
title: "Rotate MPG user passwords from flyctl"
description: "Rotate Managed Postgres user passwords from flyctl with fly mpg users rotate-password."
date: "2026-10-07"
author: "Vincent Charlebois"
url: "https://fly.io/changelog/rotate-postgres-passwords-flyctl/"
discussion: "https://community.fly.io/t/rotate-mpg-user-passwords-from-flyctl/28769"
---

# Rotate MPG user passwords from flyctl

Managed Postgres password rotation has been available in the dashboard and Machines API for a while. As of [flyctl v0.4.113](https://github.com/superfly/flyctl/releases/tag/v0.4.113), you can do it from the CLI too:

```bash
fly mpg users rotate-password <CLUSTER_ID> --username <USER>
```

This is available for MPG v2 clusters only, including the `fly-user` account. The command asks for confirmation and prints the new password.

For scripts, pass `--yes --json` to skip confirmation and get the username and password as JSON. Both the cluster ID and `--username` must be specified.

The old password stops working for new connections. Existing sessions stay connected by default; add `--kill-sessions` to terminate that user’s open sessions after rotation.

Afterward, update any applications and `DATABASE_URL` secrets that use the old password. New connections using the old credentials will fail.